- Vulnerability/
- RHSA-2023:0446
RHSA-2023:0446: Moderate: go-toolset:rhel8 security and bug fix update
First published: Wed Jan 25 2023(Updated: )
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. <br>Security Fix(es):<br><li> golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)</li> <li> golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)</li> <li> golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> Internal linking fails on ppc64le (BZ#2144545)</li> <li> crypto testcases fail on golang on s390x [rhel-8] (BZ#2149313)</li>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/delve | <1.8.3-1.module+el8.7.0+15126+0e0a42d9 | 1.8.3-1.module+el8.7.0+15126+0e0a42d9 |
| redhat/go-toolset | <1.18.9-1.module+el8.7.0+17845+708ebe87 | 1.18.9-1.module+el8.7.0+17845+708ebe87 |
| redhat/golang | <1.18.9-1.module+el8.7.0+17640+84246675 | 1.18.9-1.module+el8.7.0+17640+84246675 |
| redhat/golang-docs | <1.18.9-1.module+el8.7.0+17640+84246675 | 1.18.9-1.module+el8.7.0+17640+84246675 |
| redhat/golang-misc | <1.18.9-1.module+el8.7.0+17640+84246675 | 1.18.9-1.module+el8.7.0+17640+84246675 |
| redhat/golang-src | <1.18.9-1.module+el8.7.0+17640+84246675 | 1.18.9-1.module+el8.7.0+17640+84246675 |
| redhat/golang-tests | <1.18.9-1.module+el8.7.0+17640+84246675 | 1.18.9-1.module+el8.7.0+17640+84246675 |
| redhat/delve | <1.8.3-1.module+el8.7.0+15126+0e0a42d9 | 1.8.3-1.module+el8.7.0+15126+0e0a42d9 |
| redhat/delve-debuginfo | <1.8.3-1.module+el8.7.0+15126+0e0a42d9 | 1.8.3-1.module+el8.7.0+15126+0e0a42d9 |
| redhat/delve-debugsource | <1.8.3-1.module+el8.7.0+15126+0e0a42d9 | 1.8.3-1.module+el8.7.0+15126+0e0a42d9 |
| redhat/go-toolset | <1.18.9-1.module+el8.7.0+17845+708ebe87 | 1.18.9-1.module+el8.7.0+17845+708ebe87 |
| redhat/golang | <1.18.9-1.module+el8.7.0+17640+84246675 | 1.18.9-1.module+el8.7.0+17640+84246675 |
| redhat/golang-bin | <1.18.9-1.module+el8.7.0+17640+84246675 | 1.18.9-1.module+el8.7.0+17640+84246675 |
| redhat/golang-race | <1.18.9-1.module+el8.7.0+17640+84246675 | 1.18.9-1.module+el8.7.0+17640+84246675 |
| redhat/golang-bin | <1.18.9-1.module+el8.7.0+17640+84246675 | 1.18.9-1.module+el8.7.0+17640+84246675 |
| redhat/go-toolset | <1.18.9-1.module+el8.7.0+17845+708ebe87 | 1.18.9-1.module+el8.7.0+17845+708ebe87 |
| redhat/golang | <1.18.9-1.module+el8.7.0+17640+84246675 | 1.18.9-1.module+el8.7.0+17640+84246675 |
| redhat/golang-bin | <1.18.9-1.module+el8.7.0+17640+84246675 | 1.18.9-1.module+el8.7.0+17640+84246675 |
| redhat/go-toolset | <1.18.9-1.module+el8.7.0+17845+708ebe87.aa | 1.18.9-1.module+el8.7.0+17845+708ebe87.aa |
| redhat/golang | <1.18.9-1.module+el8.7.0+17640+84246675.aa | 1.18.9-1.module+el8.7.0+17640+84246675.aa |
| redhat/golang-bin | <1.18.9-1.module+el8.7.0+17640+84246675.aa | 1.18.9-1.module+el8.7.0+17640+84246675.aa |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What are the security vulnerabilities associated with RHSA-2023:0446?
The vulnerabilities include unbounded memory consumption in the 'archive/tar' package and issues in 'net/http/httputil: ReverseProxy'.
How do I fix RHSA-2023:0446?
To fix RHSA-2023:0446, update the affected packages to the specified remedied versions.
What is the impact of the vulnerability identified in RHSA-2023:0446?
The vulnerability could lead to excessive memory consumption, potentially causing denial of service.
Which packages are affected by RHSA-2023:0446?
Affected packages include delve, go-toolset, golang, golang-docs, golang-misc, and others.
Is there a recommended version to upgrade to for fixing RHSA-2023:0446?
Yes, upgrade to the specified versions such as delve 1.8.3 and golang 1.18.9.
- agent/severity
- agent/type
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/title
- agent/description
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2023:0446
- agent/software-canonical-lookup
- agent/remedy
- agent/references
- agent/tags
- agent/event
- agent/source
- package-manager/redhat